v1.0.0-rc.2

The second release candidate of Primary Path 1.0. Two fixes found while
testing rc.1 by following the public documentation; nothing else
changed. Use rc.2 instead of rc.1.

For what is in 1.0, compatibility, known limits and where to report
problems, see the
1.0.0-rc.1 notes.

Fixed

• The Python SDK (primarypath-sdk[async], and with it every framework
  integration and the demos) and primarypath-server now require
  httpx<1. httpx 1.0 drops AsyncClient; with no upper bound, the
  day it ships as a stable release a fresh install would break at the
  first async call.
• The drangue integration accepts a run_id used again with a fresh
  drangue store, such as running a demo a second time. 1.0.0-rc.1 keyed
  each batch of run events by its position in the run alone, so the
  second run's events collided with the first's and the service refused
  them (422). Batches are now keyed by their contents: a re-entered run
  still never duplicates events, and a new run is recorded.

Get it

curl -fsSLO https://github.com/om-er/primarypath-releases/releases/download/v1.0.0-rc.2/docker-compose.yml
docker compose up -d --wait
python3 -m venv demo && . demo/bin/activate
pip install "primarypath-demos==1.0.0rc2"
primarypath-demo refunds

The Helm chart is oci://ghcr.io/om-er/charts/primarypath --version 1.0.0-rc.2;
everything else is on the download page.

Artifacts

• Image: ghcr.io/om-er/primarypath:1.0.0-rc.2 (digest sha256:e50e3cd827eb6f5d47f8ee796f174f01e78af320dfed771a9dc6dc1b02b5e7e8), linux/amd64 + linux/arm64, validated before publication (installed smoke, boot, vulnerability scan), cosign-signed, with BuildKit provenance and SBOM attestations in the registry alongside the image
• Chart: oci://ghcr.io/om-er/charts/primarypath version 1.0.0-rc.2 (digest sha256:764e2b69312a25fd0010928bd2dd2dfdfb2a0720c8094ed0e151eb91d33812ca), cosign-signed
• Wheels: attached below with SHA256SUMS, a CycloneDX SBOM and a keyless cosign signature per file (<file>.sigstore.json); the same wheels on PyPI, uploaded by this workflow with PEP 740 attestations
• @primarypath/client npm tarball attached below, signed the same way
• docker-compose.yml (+ the docker-compose.prod.yml overlay): the image pinned by the digest above, signed the same way
• GitHub build-provenance attestations: none for this release (the repository is private; GitHub does not offer them to user-owned private repositories). Provenance is the cosign signatures above plus the BuildKit attestations inside the image.

How to verify each of these: the "Verifying a download" page of the documentation.

v1.0.0-rc.1

The first public release candidate of Primary Path 1.0: a self-hosted
approval inbox and tamper-evident audit trail for AI agents that take
real actions. An agent proposes a consequential action, the run pauses,
a person with the right role decides with the agent's full reasoning in
front of them, and the agent resumes. Every step is recorded in a
hash-chained, Ed25519-signed log that anyone can verify offline, without
trusting the server that wrote it.

This is a release candidate: install it, run it, break it. If nothing
critical turns up, 1.0.0 follows with the same contents.

What is in 1.0

• The inbox. Pending cases with the tool, the exact arguments and
  the agent's reasoning; approve, reject with a reason, or send a case
  back for changes, and the agent's revision shows what changed.
  Keyboard-first, with bulk decisions and dual control (two different
  people) where policy asks for it. Decisions can also be made from
  Slack or Microsoft Teams by allowlisted users, into the same record.
• Any agent stack. Two HTTP calls govern any agent. Python and
  TypeScript SDKs, integrations for LangGraph, the OpenAI Agents SDK,
  the Claude Agent SDK and drangue, and an MCP gateway that needs no
  agent changes.
• Execution grants. Every approval carries a signed, single-use
  grant bound to that exact action. An executor that holds the tool's
  credentials (the MCP gateway by default, or your own proxy with the
  SDK's verify_grant) checks it and redeems it once.
• A record you can prove. Hash-chained events, one chain per agent,
  append-only in the database, Ed25519-signed exports.
  primarypath-verify checks an export on an air-gapped machine against
  a key you pinned and names the exact record if anything was changed;
  the console verifies in the browser, and --report writes a readable
  evidence pack for auditors. Events stream to Splunk, Elastic or syslog.
• Policy and rollout. Which actions need a human, and who (approver
  groups from your IdP); SLAs with reminders and escalation; budgets
  that can force a review or refuse an action; evaluation gates a
  deploy pipeline can block on; and a path from assisted to sampled to
  autonomous that an action earns from its track record.
• Operations. OIDC single sign-on with role mapping, separate tokens
  for agents and operators, a Docker Compose setup with a production
  overlay, a Helm chart hardened to the restricted Pod Security
  Standard, Prometheus metrics, and signing keys in an HSM via PKCS#11.
  No telemetry, no license server, no update check.

Get it

Evaluate on one machine with Docker (a release candidate is not
latest, so use its tag in the URL):

curl -fsSLO https://github.com/om-er/primarypath-releases/releases/download/v1.0.0-rc.1/docker-compose.yml
docker compose up -d --wait

Then open http://127.0.0.1:8123 and run the demos:

python3 -m venv demo && . demo/bin/activate
pip install "primarypath-demos==1.0.0rc1"
primarypath-demo refunds

pip installs a release candidate only when asked for it by version (or
with --pre). The Helm chart is
oci://ghcr.io/om-er/charts/primarypath --version 1.0.0-rc.1.
Everything else is on the download page,
and Verifying a download
shows how to check each file's signature.

Compatibility

From 1.0.0, versions follow semantic versioning, as
the compatibility policy
sets out. A release candidate can still change before 1.0.0; anything
that does is listed in the next candidate's notes.

Known limits

• Primary Path governs the actions routed through it. An agent that
  holds a tool's credentials directly can act without asking; put the
  credentials behind an executor that checks grants. The
  threat model
  states this and the other limits.
• The drangue integration runs its tools inside the agent, so it does
  not redeem the grant it receives; redemption happens at a separate
  executor.
• Postgres 16 is the tested database.
• On Apple Silicon, run the image under amd64 emulation inside Docker
  Desktop (DOCKER_DEFAULT_PLATFORM=linux/amd64 docker compose up -d --wait --pull always); real arm64 Linux hosts are unaffected.

Reporting problems

Security issues: privately, through
a security advisory
on the releases repository (security policy).
Everything else: an issue
on the same repository.

For deployments of the pre-1.0 releases

Changes since 0.8.2, the last pre-1.0 release:

Added

• primarypath-demos, with the primarypath-demo refunds|sre command:
  the two demos, installable with pip and runnable against any service
  (--auto plays the reviewer).
• Each release carries a docker-compose.yml (and the production
  overlay) that pulls the released image pinned by digest, so the
  quickstart no longer needs a checkout to build from. Both are in
  SHA256SUMS and cosign-signed like the wheels.
• Every release is mirrored, with all its assets, to the public
  om-er/primarypath-releases repository.
• The compose app service has a healthcheck on /readyz, so
  docker compose up -d --wait returns once the service has migrated
  and can be used; the docs use it. Before, the quickstart's next
  command (curl …/healthz) could hit the server mid-start and print
  nothing.
• The nine Python packages are published to PyPI by the release
  workflow (trusted publishing), so pip install primarypath-sdk and
  the rest work directly.

Removed

• The offline license check. Primary Path is free under Apache-2.0, so
  there is nothing to license: PRIMARYPATH_LICENSE_KEY_PATH, the
  license volume in compose, the chart's license values and the
  licenseJson secret key are gone, and so are the license fields of
  GET /readyz, GET /api/admin/config and the setup summary, and the
  console's License readiness check. A deployment that still sets the
  variable or the values key boots unchanged; both are ignored.

Fixed

• The compose deployment can be configured with every setting in the
  configuration reference. It passed only the variables
  docker-compose.yml names, so Teams, SIEM forwarding, the PKCS#11
  signer, OIDC scopes, rate limits and 50 more could not be set without
  editing the file; the app service now also reads an optional .env
  beside the compose file.
• The chart's production example values no longer pin image 0.6.1:
  installing with -f examples/values-prod.yaml deployed that old image
  instead of the chart's own release. The example leaves the tag to the
  chart.
• In the case pane, an argument's label no longer breaks mid-word beside
  a long value ("reaso / n" on a rollback's reason): the label keeps its
  width, up to 40% of the row, and the value wraps.
• On the Audit page, the verification, signature and tamper-drill
  banners are as wide as the chain card they report on (900px); they ran
  the full width of the page.
• A drangue run's timeline shows the steps in the order they happened.
  The primarypath-drangue bridge sent the whole drangue event log after
  the decision, so the approval appeared before "run started" and the
  investigation that led to it. It now sends the events up to each
  proposal before requesting approval, and the rest at the end; each
  batch carries an idempotency key built from its drangue event range,
  so a bridge that crashes and re-enters the run does not duplicate
  them (within the service's idempotency window, 7 days by default).

Artifacts

• Image: ghcr.io/om-er/primarypath:1.0.0-rc.1 (digest sha256:c038ae777ea7455f43359ca8ce66408468217d3b86c94e6a1eb693b2e2bd15ab), linux/amd64 + linux/arm64, validated before publication (installed smoke, boot, vulnerability scan), cosign-signed, with BuildKit provenance and SBOM attestations in the registry alongside the image
• Chart: oci://ghcr.io/om-er/charts/primarypath version 1.0.0-rc.1 (digest sha256:10ab5663aaaef96511e6b936e51871aacda87dd8461ce3d3789e1ef3f628e7fe), cosign-signed
• Wheels: attached below with SHA256SUMS, a CycloneDX SBOM and a keyless cosign signature per file (<file>.sigstore.json); the same wheels on PyPI, with PEP 740 attestations
• @primarypath/client npm tarball attached below, signed the same way
• docker-compose.yml (+ the docker-compose.prod.yml overlay): the image pinned by the digest above, signed the same way
• GitHub build-provenance attestations: none for this release (the repository is private; GitHub does not offer them to user-owned private repositories). Provenance is the cosign signatures above plus the BuildKit attestations inside the image.

How to verify each of these: the "Verifying a download" page of the documentation.